What to do if…
your family sharing or purchase-sharing settings change and you did not change them
Short answer
Treat it as possible account access by someone else: secure the controlling account first (new password + 2-step verification + sign out other sessions), then lock down family/purchase sharing and payments.
Do not do these things
- Don’t click “security alert” links in unexpected emails/texts to “fix” it — go via the official app/account settings.
- Don’t remove devices or recovery details unless you’re sure they’re not yours (you can lock yourself out).
- Don’t assume it’s a harmless “glitch” if money, family members, organiser, or approvals changed — act quickly.
- Don’t change lots of unrelated settings at once; you’ll lose track of what changed and what fixed it.
- Don’t share one account login between family members “to simplify things” — it makes this harder to untangle.
What to do now
-
Stop new spending risk.
- If you see charges/subscriptions you don’t recognise, contact your bank/card provider to flag it, dispute where appropriate, and ask what they can do to prevent further charges (for example, a card freeze/lock in the banking app, or replacing the card).
- If the platform allows it, remove/disable the shared family payment method temporarily until you’re confident you’re back in control.
-
Secure the account that controls the sharing (before you edit sharing again).
- Change the password to a new, unique one (a passphrase is fine).
- Turn on 2-step verification / two-factor authentication.
- Use the account security page/settings to sign out of other devices/sessions so anyone already logged in is forced out.
-
Check the “ways back in” (so they can’t regain access). Do this from a device you trust.
- In the Apple/Google account security settings, review recovery email(s) and phone number(s) and remove anything you don’t recognise.
- Review your trusted/recognised devices and sign out/remove anything unfamiliar.
- Check the email account that receives your password resets (for example, your Gmail/iCloud/other email): look for unexpected forwarding rules/filters, recovery details you don’t recognise, or new sign-in alerts.
-
Lock down Family Sharing / purchase sharing (once sign-in is secured).
- Apple (Family Sharing): on iPhone/iPad, open Settings → Family (or Settings → your name → Family). Review: members, organiser, purchase sharing, and approvals/Ask to Buy; remove anyone you don’t recognise and stop purchase sharing if needed.
- Google Play (Family): open Google Play → profile icon → Settings → Family. Review family group/family manager status, Family Library settings, and purchase approval requirements; remove/stop sharing if needed.
-
Create a quick evidence trail (helps disputes/support).
- Screenshot the changed settings, unknown members, organiser/family manager details, and any unexpected purchases/subscriptions.
- Note the date/time you noticed it and keep the notification emails as records (don’t use the links inside them to sign in).
-
If you lost money or it looks like fraud, report it (UK path).
- Report cyber crime/fraud via the UK’s police reporting service (Report Fraud) for England, Wales, and Northern Ireland.
- If you live in Scotland (or the crime happened there), report via Police Scotland on 101.
What can wait
- You don’t need to decide today whether to keep family sharing at all — switching off purchase sharing temporarily is a valid safety move.
- You don’t need to “clean up” every subscription or shared item right now; first stop new spending and secure access.
- You don’t need to confront anyone immediately — regain control and save records first.
Important reassurance
This is often caused by access to one key account (Apple/Google or the email tied to recovery). A calm, ordered sequence — secure sign-in, sign out others, verify recovery routes, then fix sharing — usually stops it.
Scope note
These are first steps to stabilise and prevent further loss. If access keeps recurring, you may need platform support and/or bank fraud support next.
Important note
This is general information, not legal, financial, or cybersecurity professional advice. If you can’t confirm something safely (for example, whether a device is truly yours), take the least-risky path: secure sign-in, stop spending, and use official support channels.
Additional Resources
- https://www.ncsc.gov.uk/guidance/recovering-a-hacked-account
- https://www.ncsc.gov.uk/files/recovering-hacked-accounts-infographics.pdf
- https://support.apple.com/en-gb/102652
- https://support.apple.com/en-gb/102660
- https://support.google.com/accounts/answer/3067630?hl=en
- https://myaccount.google.com/intro/security-checkup?hl=en-GB
- https://support.google.com/families/answer/7039872?co=GENIE.Platform%3DAndroid&hl=en
- https://www.reportfraud.police.uk/